VNET Integration for HealthCare Agent Orchestrator #35
Conversation
matthiasblondeel
left a comment
matthiasblondeel
left a comment
There was a problem hiding this comment.
Still need to do some E2E testing but this looks good to me
infra/main.parameters.json
Outdated
| "fhirServiceEndpoint": { | ||
| "value": "${FHIR_SERVICE_ENDPOINT}" | ||
| }, | ||
| "networkLocation": { |
There was a problem hiding this comment.
Why even have a network location parameter, if it has to be the same as the app service.
I think you can just remove it
There was a problem hiding this comment.
this is complete
| publicNetworkAccess: 'Enabled' | ||
| ipSecurityRestrictionsDefaultAction: 'Allow' | ||
| ipSecurityRestrictionsDefaultAction: 'Deny' | ||
| ipSecurityRestrictions: ipSecurityRestrictions |
There was a problem hiding this comment.
Does this mean that by default, the web gui won't load either?
That's fine, just checking. If that is the case, maybe we can add an option to specify either your private IP range, or a "allow unsecure option"?
There was a problem hiding this comment.
For this can we add a note in network.md and have it default to Allow. We have to add their public ip or make it public or open up their corp vpn range etc. Can we for now just make it public and i will add a note in their network.md. Since everything else is also kind of public
There was a problem hiding this comment.
The problem is then in that case the ip restrictions that we have added might not be relevant any more.. let me think a bit more on this
There was a problem hiding this comment.
Changes made to introduce a new parameter that would allow you to specify ip. Have tested it with my public ip.
| @@ -0,0 +1,182 @@ | |||
| # Network Security Architecture | |||
There was a problem hiding this comment.
Add an entry in the README.md under docs
https://github.com/Azure-Samples/healthcare-agent-orchestrator/blob/main/docs/README.md
matthiasblondeel
left a comment
matthiasblondeel
left a comment
There was a problem hiding this comment.
Looks good. I'm running one more test. And have some minor doc feedback
| - [Tool Integration Guide](./docs/agent_development.md#adding-tools-plugins-to-your-agents) | ||
| - [Healthcare Scenarios Guide](./docs/scenarios.md) for implementation examples | ||
| - [Data Ingestion Guide](./docs/data_ingestion.md) for adding custom data | ||
| - [Network Architecture](./docs/network.md) for network configuration and security |
There was a problem hiding this comment.
This is good, but there is also a README under docs with additional links if you could add there
| # Override GPU instance type (only needed if not using the default Standard_NC24ads_A100_v4) | ||
| azd env set GPU_INSTANCE_TYPE Standard_NC40ads_H100_v5 | ||
|
|
||
| # Allow additional IP addresses for App Service access (for development/debugging) |
There was a problem hiding this comment.
for development/debugging or using the react client app.
There was a problem hiding this comment.
Can you also add a note under step 6 that by default the chat application won't be accessible unless someone adds their IP to the list of additional allowed IPs?
2 participants
Purpose
Introduces comprehensive network security architecture with Virtual Network (VNet) integration for the Healthcare Agent Orchestrator. Adds network isolation by deploying App Service within a dedicated VNet subnet with proper delegation and security controls
Implements Microsoft 365/Teams IP restrictions to ensure secure integration while maintaining controlled access
Establishes foundation for enhanced security options including private endpoints and Application Gateway integration
Provides configurable network parameters allowing organizations to customize VNet address spaces and subnet configurations for their environments
Does this introduce a breaking change?
Pull Request Type
What kind of change does this Pull Request introduce?
How to Test
What to Check
Verify that the following are valid
VNet and subnet creation - Confirm VNet is created with correct address space (10.0.0.0/16 default)
App Service VNet integration - Verify App Service is properly integrated with the subnet
IP restrictions configuration - Confirm Microsoft 365/Teams IP ranges are correctly applied
NSG rules - Validate Network Security Group allows HTTP/HTTPS inbound and required outbound traffic
Service endpoints - Verify service endpoints are configured
Teams bot functionality - Test that healthcare agents work correctly in Teams after deployment
Other Information
For existing deployments: This PR introduces VNet integration which requires complete recreation of deployments - App Service outbound IPs will change to the VNet subnet range and external services whitelisting your current IPs must be updated. Recommended approach: Deploy new VNet-enabled environment alongside existing one, test thoroughly, then switch traffic after verification. For fresh deployments: No impact as VNet is included from the start.